Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in Linux
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in Linux
ID: USN-4912-1
Distribution: Ubuntu
Plattformen: Ubuntu 20.04 LTS
Datum: Mi, 14. April 2021, 06:29
Referenzen: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25645
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25669
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36158
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0423
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27830
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0465
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14390
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3178
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25285
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14351
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0466
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3411
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20194
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29154
Applikationen: Linux

Originalnachricht


--===============8871669214249901320==
Content-Type: multipart/signed; micalg=pgp-sha512;
protocol="application/pgp-signature";
boundary="4wkndigzIeYF6Hbg"
Content-Disposition: inline


--4wkndigzIeYF6Hbg
Content-Type: text/plain; charset=utf-8
Content-Disposition: inlin
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-4912-1
April 13, 2021

linux-oem-5.6 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
- linux-oem-5.6: Linux kernel for OEM systems

Details:

Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux
kernel did not properly validate computation of branch displacements in
some situations. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-29154)

It was discovered that a race condition existed in the binder IPC
implementation in the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-0423)

It was discovered that the HID multitouch implementation within the Linux
kernel did not properly validate input events in some situations. A
physically proximate attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-0465)

It was discovered that the eventpoll (aka epoll) implementation in the
Linux kernel contained a logic error that could lead to a use after free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-0466)

It was discovered that a race condition existed in the perf subsystem of
the Linux kernel, leading to a use-after-free vulnerability. An attacker
with access to the perf subsystem could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)

It was discovered that the frame buffer implementation in the Linux kernel
did not properly handle some edge cases in software scrollback. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2020-14390)

It was discovered that a race condition existed in the hugetlb sysctl
implementation in the Linux kernel. A privileged attacker could use this to
cause a denial of service (system crash). (CVE-2020-25285)

It was discovered that the GENEVE tunnel implementation in the Linux kernel
when combined with IPSec did not properly select IP routes in some
situations. An attacker could use this to expose sensitive information
(unencrypted network traffic). (CVE-2020-25645)

Bodong Zhao discovered a use-after-free in the Sun keyboard driver
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service or possibly execute arbitrary code.
(CVE-2020-25669)

Shisong Qin and Bodong Zhao discovered that Speakup screen reader driver in
the Linux kernel did not correctly handle setting line discipline in some
situations. A local attacker could use this to cause a denial of service
(system crash). (CVE-2020-27830)

It was discovered that the Marvell WiFi-Ex device driver in the Linux
kernel did not properly validate ad-hoc SSIDs. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2020-36158)

Loris Reiff discovered that the BPF implementation in the Linux kernel did
not properly validate attributes in the getsockopt BPF hook. A local
attacker could possibly use this to cause a denial of service (system
crash). (CVE-2021-20194)

Adam Zabrocki discovered that the kprobes subsystem in the Linux kernel did
not properly detect linker padding in some situations. A privileged
attacker could use this to cause a denial of service (system crash) or
possibly expose sensitive information. (CVE-2021-3411)

后匂 discovered that the NFS implementation in the Linux kernel did not
properly prevent access outside of an NFS export that is a subdirectory of
a file system. An attacker could possibly use this to bypass NFS access
restrictions. (CVE-2021-3178)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
linux-image-5.6.0-1053-oem 5.6.0-1053.57
linux-image-oem-20.04 5.6.0.1053.49

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://ubuntu.com/security/notices/USN-4912-1
CVE-2020-0423, CVE-2020-0465, CVE-2020-0466, CVE-2020-14351,
CVE-2020-14390, CVE-2020-25285, CVE-2020-25645, CVE-2020-25669,
CVE-2020-27830, CVE-2020-36158, CVE-2021-20194, CVE-2021-29154,
CVE-2021-3178, CVE-2021-3411

Package Information:
https://launchpad.net/ubuntu/+source/linux-oem-5.6/5.6.0-1053.57


--4wkndigzIeYF6Hbg
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEpgY7tWAjCaQ8jrvULwmejQBegfQFAmB2Gf8ACgkQLwmejQBe
gfSxVw//SPugIPFs/r51ttXj3drREe68tYejaCPfx4CEllVt4WDbN76Ia2TA2ctZ
cMpQo9G3UUINEotkigek/BeGLPtnVieZWER6RzwKBgdVYyqhKG3ALnYqKYo47qX/
AJA1GYmQBNB+yVszEts4fdBfOQaDEW3iGb1F065+Z5nhYMV//cjbvXOF0zLvRtON
yL8eTmce22tMF6C+rh0wWW5/TobSg7ehHvCzAy+K65DnJyQiQDLrtHTnOS0BMEnp
pSYor1CqESPcloMkT9QNSv63UxflbYxKuiF4u9LBFnQG2DyofNBjz8HBe8yY8Tp4
KdhM0l8864z7itEnrkTFwpl1B/pS2gYVHcdx75jOk67DoOAUA/UtfsJ8bWU8Q+x2
UNpATS4/i9y/cpD/0MReZ2ACwUUxzGOsU+jZaj7D64hAifFza8plE9jM2GI6I2Yy
1lZ4ltgCwtCsLkGcttNvmaLGuoIGAzLf3r5KmA0Z3snsExf5+B0bMF7wRbgkiP3w
kBbunNYKJHdQJk7k/RRbvdfkVdQVwTI4i8YgItn8FKxEBTHmRm2/lsmfW0epHqXb
6CbNEHQGx5dFFi2FUNfz/NLpCpzxILeu/NCJI2fuEsOGe/6qpM3n5RDLaeuoy+F9
Ufzx3L9X5neBw0uVmJu4xW4+E/VoleSUUYMnLnN7B5+qDuycNaU=
=P306
-----END PGP SIGNATURE-----

--4wkndigzIeYF6Hbg--


--===============8871669214249901320==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5
LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl
IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj
dXJpdHktYW5ub3VuY2UK

--===============8871669214249901320==--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung